WordPress JupiterX Core Plugin <= 4.7.5 is vulnerable to Broken Authentication

Software JupiterX Core Type Plugin Vulnerable versions = 4.7.5 Fixed in 4.7.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Broken Authentication CVE CVE-2024-7781 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 4950f50fad7a Credits Geo Void...

WordPress Email Subscribers & Newsletters Plugin <= 5.7.34 is vulnerable to Broken Access Control

Software Email Subscribers & Newsletters Type Plugin Vulnerable versions = 5.7.34 Fixed in 5.7.35 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-8771 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d3427c89899f Credits Michelle...

WordPress Bulk NoIndex & NoFollow Toolkit Plugin <= 2.15 is vulnerable to Cross Site Scripting (XSS)

Software Bulk NoIndex & NoFollow Toolkit Type Plugin Vulnerable versions = 2.15 Fixed in 2.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8803 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 78a9bff492c8 Credits vgo0...

WordPress Multi Step for Contact Form Plugin <= 2.7.7 is vulnerable to SQL Injection

Software Multi Step for Contact Form Type Plugin Vulnerable versions = 2.7.7 Fixed in 2.7.8 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-47331 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID a27c5e08d690 Credits Hakiduck Required privilege...

WordPress ProfileGrid Plugin <= 5.9.3.2 is vulnerable to Cross Site Scripting (XSS)

Software ProfileGrid Type Plugin Vulnerable versions = 5.9.3.2 Fixed in 5.9.3.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8861 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 907c16cddd3d Credits Francesco Carlucci...

WordPress Uncanny Groups for LearnDash Plugin <= 6.1.0.1 is vulnerable to Privilege Escalation

Software Uncanny Groups for LearnDash Type Plugin Vulnerable versions = 6.1.0.1 Fixed in 6.1.1 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-8349 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID 0a9f41b67f...

WordPress Ninja Forms Plugin <= 3.8.15 is vulnerable to Cross Site Scripting (XSS)

Software Ninja Forms Type Plugin Vulnerable versions = 3.8.15 Fixed in 3.8.16 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3866 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 8846b83daea8 Credits wesley wcraft Required...

WordPress Templately Plugin <= 3.1.2 is vulnerable to Broken Access Control

Software Templately Type Plugin Vulnerable versions = 3.1.2 Fixed in 3.1.3 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-47308 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID e4f1c6a95d39 Credits Joshua Chan Required privile...

WordPress WS Form LITE Plugin <= 1.9.238 is vulnerable to Cross Site Scripting (XSS)

Software WS Form LITE Type Plugin Vulnerable versions = 1.9.238 Fixed in 1.9.244 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47320 Patch priority Medium CVSS severity Medium 7.1 Developer WS Form PSID cb1829e55bbc Credits savphill Required privilege...

WordPress Use Any Font Plugin <= 6.3.08 is vulnerable to Cross Site Request Forgery (CSRF)

Software Use Any Font Type Plugin Vulnerable versions = 6.3.08 Fixed in 6.3.09 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-47305 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 15cf8c1d7c9e Credits Rafie Muhammad...

WordPress Bit Form – Contact Form Plugin Plugin <= 2.13.10 is vulnerable to Arbitrary File Upload

Software Bit Form – Contact Form Plugin Type Plugin Vulnerable versions = 2.13.10 Fixed in 2.13.11 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2024-47319 Patch priority Low CVSS severity Low 8 Developer Claim ownership PSID 4ad1bd9ca230 Credits Certus Cybersecurity...

WordPress Easy PayPal Events Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Easy PayPal Events Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-8476 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 61a92fe21d38 Credits Krzysztof Zając...

WordPress Beam me up Scotty – Back to Top Button Plugin <= 1.0.21 is vulnerable to Cross Site Scripting (XSS)

Software Beam me up Scotty – Back to Top Button Type Plugin Vulnerable versions = 1.0.21 Fixed in 1.0.22 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8741 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID b85fc952fded...

WordPress WordPress Meta Data and Taxonomies Filter (MDTF) Plugin <= 1.3.3.3 is vulnerable to Broken Access Control

Software WordPress Meta Data and Taxonomies Filter MDTF Type Plugin Vulnerable versions = 1.3.3.3 Fixed in 1.3.3.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-8623 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 0cac1edc31...

WordPress MH Board Plugin <= 1.3.2.1 is vulnerable to Local File Inclusion

Software MH Board Type Plugin Vulnerable versions = 1.3.2.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-44017 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 729ae474bd3b Credits tahu.datar Required privilege Unauthenticated...

WordPress Contact Form 7 Campaign Monitor Extension Plugin <= 0.4.67 is vulnerable to Broken Access Control

Software Contact Form 7 Campaign Monitor Extension Type Plugin Vulnerable versions = 0.4.67 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-44019 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 11a927ecc073 Credits Abdi...

WordPress NiceJob Plugin < 3.6.5 is vulnerable to Cross Site Scripting (XSS)

Software NiceJob Type Plugin Vulnerable versions 3.6.5 Fixed in 3.6.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-44025 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID afa3856f254d Credits stealthcopter Required privilege Contributor...

WordPress AnWP Football Leagues Plugin <= 0.16.7 is vulnerable to Cross Site Scripting (XSS)

Software AnWP Football Leagues Type Plugin Vulnerable versions = 0.16.7 Fixed in 0.16.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8917 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1862a8d1a35e Credits Francesco Carluc...

WordPress WordPress Meta Data and Taxonomies Filter (MDTF) Plugin <= 1.3.3.3 is vulnerable to SQL Injection

Software WordPress Meta Data and Taxonomies Filter MDTF Type Plugin Vulnerable versions = 1.3.3.3 Fixed in 1.3.3.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-8624 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 72c934040045 Credits Krzysztof Zając...

WordPress WPSPX Plugin <= 1.0.2 is vulnerable to Local File Inclusion

Software WPSPX Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2024-44034 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 14fb489d8c25 Credits tahu.datar Required privilege Unauthenticated...